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Abstract 


Let E be an elliptic curve described by either an Edwards model or a twisted Edwards 
model over Fp, namely, E is defined by one of the following equations + 

x^y^), a® — a ^ 0 mod p, or, +y^ = 1 + dx'^y^, ad{a — d) ^ 0 mod p, respectively. We 
express the number of rational points of E over Fp using the Gaussian hypergeometric 


series 2 U 


X where e and (f> are the trivial and quadratic characters over Fp 


V ^ / 

respectively. This enables us to evaluate |if(Fp)| for some elliptic curves E, and prove the 
existence of isogenies between E and Legendre elliptic curves over Fp. 


1 Introduction 

In [1] Greene initiated the stndy of Gaussian hypergeometric series over finite fields. 
These series are analogous to the classical hypergeometric series. Several authors man¬ 
aged to find congruence relations satisfied by special values of these series, see |S]. Many 
special values of these series were determined. 

One of the striking aspects of hypergeometric series is that some of their special 
values are linked to the number of rational points on some families of algebraic curves 
over hnite helds. Two families of elliptic curves were discussed in [5]. The number 
of rational points of an elliptic curve E described by a Legendre model, namely, = 
a;(a;— l)(x —A), A(A — 1) ^ 0 mod p, over the finite field Fp satisfies the following identity 


|E(Fp)| = 1 -bp-bp 0 (-l) • 2F1 
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where e and 0 are the trivial and qnadratic characters over Fp respectively. The 


latter identity was nsed to evalnate the hypergeometric series 2-^1 



A when 


A G {—1,1/2, 2}. If E is defined by a Clansen model, y'^ = (x — + A), A(A + 1) ^ 0 

mod p, then 




Again this was exploited in order to evalnate the hypergeometric series 3 F 2 


at some specihc valnes of A. 

More Ganssian hypergeometric series appear in formulas describing the number of 
rational points on higher genus curves over finite fields. Some of these formulas can be 
found in [ 1 ] where the following family of algebraic curves are discussed 


p' = x{x — l)(a: — A), A(A — 1) ^ 0 mod p, I >2. 


In this note we are interested in elliptic curves described by Edwards models or 
twisted Edwards models, namely 


x‘^ + y‘^ = a^(l + — a ^ 0 mod p; 

ax‘^ + = 1 + dx'^y'^, ad{a — d) ^ 0 mod p 


respectively. 

Edwards models of elliptic curves were proposed in [5] and have been used since then 
in many cryptographic applications. The main advantage enjoyed by these curves is that 
the group law is simpler to state than on other models representing elliptic curves. In 
addition, any elliptic curve defined over an algebraically closed field k can be expressed 
in the form +p^ = a^(l + x^y'^). Twisted Edwards models appeared for the first time 
in [ 2 ] to express more elliptic curves over finite fields with the addition law being easily 
formulated. 

We show that the number of rational points on an Edwards curve E over a hnite 



held Fp can be written in terms of the Gaussian hypergeometric series 2 F 1 


Gonsequently, we evaluate |E(Fp)| for some E. Then we prove that every Edwards 


2 








curve is isogenous to a Legendre curve over Fp. Finally, it turns out that the number 
of rational points on a twisted Edwards curve E is described using special values of 


the hypergeometric series 2 F 1 



X . This sets the stage for evaluating |E(Fp)| for 


some twisted Edwards curves E. 

2 Gaussian hypergeometric series 

Throughout the note p will be an odd prime unless otherwise stated. We extend multi¬ 
plicative characters x defined over F^ to Fp by setting x(0) = 0. We write x to denote 
l/y. The trivial and quadratic characters will be denoted by e and 0 respectively. Let 
J{A,B) denote the Jacobi sum 


J{A,B) = E A{x)B{l-x) 




where A and B are characters over Fp. Let Aq, Ai ,..., A^ and Bi ,..., Bn be characters 
defined over Fp. The Gaussian hypergeometric series is 



where the sum is over all characters over Fp and 



The following properties of the symbol 



Lemma 2.1. For any characters A and B over Fp, one has: 



where 6{x) = 1 if x = 0 and S(x) = 1 if 


X 0; 

h) Z(1 - 



where 6{x) = 1 if x = 0 and S{x) = 0 if 


X 7 ^ 0; 
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c) 







(f) = (1) = + wh,re5(A) 



i?x( 4 ). 


1 if A = e and ^(A) = 0 otherwise; 


3 Rational points on Edwards curves 

Let E be an elliptic curve over a field k with char k ^ 2 defined by an Edwards model 

+ y^ = a^(l + where — a 7^ 0. 

Such an elliptic curve will be called an Edwards curve. If {xi,yi) and (0:2,2/2) are two 
points on E, then these two points add up to 

1 xiy2 + X2yi 1 ym - xiX2 

a 1 + xiX2yiy2 a 1 - xiX2yiy2 

There are two points at infinity, namely if we homogenize the defining equation, we get 

2 2 I 22 2 / 4 I 2 2 \ 

X z + y z = a [z + x y ) 


and the points at infinity are {x : y : z) E {(1 : 0 : 0), (0 : 1 : 0)}. 

We will need the following lemma to count rational points on an Edwards curve. 

Lemma 3 . 1 . Let A be a character on Fp and a G Fp^. The following identities hold: 


(A^\ _ { 0 ^( 4 ) ^fA^e 

^ I 2 ^ ^fA = e 

b) 

x&¥p ^ ^ 


Proof: a) In Lemma iTTl fL put B 



pA{a^)[^.^) 

p — 2 


^fA^ 
tfA = 


- e and y 


A. This yields 


e 

e 
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(j)A 


According to Lemma 12711 ei. the product above ^ )^(4) if A 7 ^ e, and it is (2 
To prove b), we notice that 




a:GF- 




Setting u = -, the above sum becomes 

2 2a 


A(a^ — x^) = A (4a^) A(m)A(1 — u) 


xeFp 


neFp 


= A(4a")J(A,A) =pA(-4a")(^ 


Using Lemma [2.11 dh one has ~ Part b) now follows from a). □ 

The following theorem relates the number of rational points on an Edwards curves 
over Fp to a Gaussian hypergeometric series. 


Theorem 3.2. Let E/¥p he described by + y^ = a?{l + x^y^) where or ^ a mod p, p 
is an odd prime. Then 


|E(Fp)| = 1 + p + p ■ 2F1 


1 - a" 


Proof: The dehning equation of E can be written as: 


y = 


— x^ 

1 — c?x^' 
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Bearing in mind that there are two points at inhnity, one has 

|B(F,)| = 


= 2 + p + 



xeFp\{±a“l 

= 2 + p + 

E 


3;eFp\{±a~l 

= 2 + p + 

E 


xeFp\{±a“l 

= 2 +P + 

P 


P 1 

xSFp 

= 2 +P + 

P y 

P — 1 ^ 


a? — 


1 — 


1 + 


a? — a 

a-2 _ ^2 


— a 




a-2 _ x‘2 I \a~‘^ — x‘^ 


c? — a 


E E 


X 


d} — a 


XJ " \a~‘^ — x^ 


X, 


fa^ - a ‘^)^x{a ^ - x'^). 




The third equality follows from Lemma [2T] a). Now we use Lemma [3. li b) to obtain the 
following identity: 


l-^(®'p)l — 2 + P + 




Lemma [2T] di gives 1) = )x(—1), thus 


dx\ (4>x\ (. 4 \ ,2 - P 


|£(F,)| = 2+j, + ^\Y^ ^ 

„ , , p‘ r z' 4>x\ (4>x 

2 + p + ;:vt Z. 


X / \ x 


X(l-a‘)-r + 


2 — p 
p 2 


= 1 + p + p • 2 -Fi 


1 -a^ 


□ 


The Legendre family of elliptic curves is the one defined by 

Ex', = x{x — l)(a; — A), A(A — 1) ^ 0 mod p. 


Theorem 1 in [5] states that |ii^A(lFp)| = 1 + p + p0(—1) ■ 2-^1 


A . Since two 


elliptic curves over Fp are isogenous if and only if they have the same number of rational 
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points, comparing to the number of rational points of an Edwards curve E over 

Fp defined by + y‘^ = a^(l + x^y‘^), see Theorem 13.21 yields that E is isogenous to the 
Legendre elliptic curve Ei_ai if p = 1 mod 4. In fact, every Edwards curve is isogenous 
to a Legendre curve over Fp. 

Corollary 3.3. Let E be defined by + y'^ = a^(l + over Fp, where p is an 

odd prime and oP ^ a mod p. Then E is isogenous to the Legendre elliptic curve 
Ea‘i '■ y^ = x{x — l)(x — a^). 


Proof: According to Theorem 1 in [5], |^a4(Fp)| = 1 + p + p 0 (-l) • 2 E 1 
The following identity is Theorem 4.4 (i) of |1] 



2P1 


X 


= 0 (-l) • 2 E 1 


X 


□ 


Now set X = and use Theorem 13.21 Consequently, E and E^^ have the same number 
of rational points over Fp. It follows that they are isogenous over Fp. 

We recall the following Proposition which can be found as Theorem 2 in |5]. 

Proposition 3.4. Let p be an odd prime. If X & { — 1 , 1 / 2 , 2 }, then 


2Fi 


A = 


0 if p = 3 mod 4, 

2x-(-i)( +»+ )/ p 4^ = p, x is odd. 


Corollary 3.5. Let E/¥p be defined by x^ + y‘^ = a^(l + x‘^y‘^) where afi ^ a mod p. If 
e { — 1,1/2, 2}, then 


l^(Fp)| 


1 + p if p = 3 mod 4, 

1 + p + 2 x • (— 1 )C+ 2 ^+i )/2 p 4 ^ = p, X is odd. 


Proof: This follows immediately from Corollary 13.31 


□ 


4 Rational points on twisted Edwards curves 

Twisted Edwards curves were introduced in [2] as generalizations of Edwards curves. 
These curves include more elliptic curves over finite fields than Edwards curves do. A 
twisted Edwards curve is an elliptic curve defined by the following twisted Edwards model 

2 I 2 1,722 

ax + y = 1 + dx y 
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where ad{a — d) ^ 0. For any field k with char(A;) ^ 2, any elliptic curve over k with 
three fc-rational points of order 2 is 2-isogenous over k to a twisted Edwards curve, see 
Theorem 5.1 of [2], hence they have the same number of rational points over Fp. 


Lemma 4.1. The following equality holds for any character A over Fp 


x&¥p 


P0(-1) 



Proof: We recall that the number of solutions of the equation = a mod p is given 
by Na = (j){a) + 1. In fact W = 2 if a G Fp^, a 7 ^ 0, A^o = 1, and Na = 0 otherwise. We 
consider the following sum: 


- x) 


-x) - 1) 

X 

^ Xix)(p{l - x)N^ - ^ xix)(p{l - x) 

X X 

2 ^ X{x)(j){l X{x)(j){l - x) 

xeF2 X 

X(a;2)0(l - x{x)(j){l - x). 


Therefore, 


Yx{.x^)(t>iX - X^) 


J{.(t>xA) + J{xA) 





Using Lemma [2.11 c). one has 






□ 


Theorem 4.2. Let E/¥p he described by ax‘^ + = 1 + dx'^y‘^ where ad{a — d)^0 mod 

p, p is an odd prime. Then 


l^(Fp)| 


2 + p + 0 (a) +p 0 (-a) 


2 F 1 





|E(Fp)| = 2 + p - 0(d) +p0(-a) • 2 F 1 
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In particular, 











Proof: We observe that we can write the above twisted Edwards model as 


2 1 - W 

X = 


a — dy'^ 

We set b = a~^d. The number of rational points of E over Fp is given by 

1 — y‘^ 

- I 

y&p 


|B(Fp)| = 


2+P+ ^ ( a - 1 ^ 2 ) = 2 + P + ^ 0 (1 - y^) 0 (« - dy'^) 


y&¥p\{Vad 1 } 

2+P + (j){a) 0(1 - |/^)0(1 - by^) 


y&p 


2 +p + 0(a) ^0(1-1/^ 

y&p 


Hbu^) + 

p -1 ^ VX 


The last equality follows from Lemma [2.11 bh According to Lemma [4.11 one obtains 

p(j){a) ^ f 0 x^ 


l-^(®'p)l ~ 2 + p + 0 (a) + 


p-irVx; 


0 X 


p-1 ^ V X 


0x\ X 

X / V0X 


X{i>) 


= 2 + p + 0 (a)+p 0 (-a) 


iFr 


a I + 2 T 1 


2-^1 


a ^d 


However, Corollary 3.16 in |1] indicates that 


2-^1 


a I = ('^^0(~o M)e(l — a ^d)-0(—l)e(a ^d) + ^-0(—l)d(l — a ’ 

-- 0 (—a“^d)- 0 (—!)• 

p p 


This proves the theorem. 


□ 


Corollary 4.3. Let p he an odd prime. Let E/¥p he defined by ax"^ + = 1 + dx^y'^ 

where ad{a — d) ^ 0 mod p. If A := a~^d G { — 1, 1 / 2 , 2}, then 


l^(Fp)| 


2 + p — 0(d) if p = 3 mod 4, 

2 + p — 0 (d) + 2x ■ (j){a) ■ (— 1 )C+ 2 ^+i )/2 p ^ 4 ^ = p, x is odd. 


d)d(e) 
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Proof: This follows from Theorem 14.21 and Proposition 13.41 


□ 


We remark that any Legendre curve is isogenous to a twisted Edwards curve over 
Fp. Indeed, any elliptic curve E with three Fp-rational points of order 2 defined by 
= x{x — a){x — h) is isogenous to the twisted Edwards curve Aax"^ +7/^ = 1 + Abx'^y'^, 
see Theorem 5.1 in |2]. Thus the formula for the number of rational points on a Legendre 
elliptic curve over Fp, Theorem 1 of [5] , follows as a special case from Theorem 14.21 
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